Addressable::IDNA.to_unicode decodes Punycode labels (labels beginning with xn–) that contain characters which change how text is displayed without being visible themselves. These include bidirectional controls such as U+202E RIGHT-TO-LEFT OVERRIDE and U+2066–U+2069, zero-width characters, and other invisible format characters. Addressable::URI#display_uri uses to_unicode, so it can display a host whose characters appear reordered or which looks identical to a different host. For example, the host of http://xn–abcmoc-dm0c.com/ is displayed as abc, U+202E, moc.com, and the override makes everything after abc render right to left.

Parsing, host, normalized_host and any connection made from the URI are not affected. Only the displayed form is. Applications that show display_uri to users (link previews, chat and email clients, admin interfaces) can be used to make a malicious domain look like a trusted one.

In the pure-Ruby IDNA implementation, all such characters are decoded, including those that IDNA's nameprep profile prohibits. In the native IDNA implementation, used when libidn and the idn-ruby gem are installed, libidn rejects most of them, but not characters added to Unicode after version 3.2, such as U+061C and U+2066–U+2069.

Credits

Reported by @andrewstellman.